Splunk to Azure Monitor log query
This article is intended to assist users who are familiar with Splunk to learn the Kusto query language to write log queries in Azure Monitor. Direct comparisons are made between the two to understand key differences and also similarities where you can leverage your existing knowledge.
Structure and concepts
The following table compares concepts and data structures between Splunk and Azure Monitor logs.
|Deployment unit||cluster||cluster||Azure Monitor allows arbitrary cross cluster queries. Splunk does not.|
|Data caches||buckets||Caching and retention policies||Controls the period and caching level for the data. This setting directly impacts the performance of queries and cost of the deployment.|
|Logical partition of data||index||database||Allows logical separation of the data. Both implementations allow unions and joining across these partitions.|
|Structured event metadata||N/A||table||Splunk does not have the concept exposed to the search language of event metadata. Azure Monitor logs has the concept of a table, which has columns. Each event instance is mapped to a row.|
|Data record||event||row||Terminology change only.|
|Data record attribute||field||column||In Azure Monitor, this is predefined as part of the table structure. In Splunk, each event has its own set of fields.|
|Types||datatype||datatype||Azure Monitor datatypes are more explicit as they are set on the columns. Both have the ability to work dynamically with data types and roughly equivalent set of datatypes including JSON support.|
|Query and search||search||query||Concepts are essentially the same between both Azure Monitor and Splunk.|
|Event ingestion time||System Time||ingestion_time()||In Splunk, each event gets a system timestamp of the time that the event was indexed. In Azure Monitor, you can define a policy called ingestion_time that exposes a system column that can be referenced through the ingestion_time() function.|
The following table specifies functions in Azure Monitor that are equivalent to Splunk functions.
Also note that while
Also note that Splunk uses one-based indices. Azure Monitor notes zero-based indices.
|regex||matches regex||In Splunk,
|Splunk's function returns a number from zero to 231-1. Azure Monitor' returns a number between 0.0 and 1.0, or if a parameter provided, between 0 and n-1.|
In Azure Monitor, Splunk's equivalent of relative_time(datetimeVal, offsetVal) is datetimeVal + totimespan(offsetVal).
(1) In Splunk, the function is invoked with the
eval operator. In Azure Monitor, it is used as part of
(2) In Splunk, the function is invoked with the
eval operator. In Azure Monitor, it can be used with the
The following sections give examples of using different operators between Splunk and Azure Monitor.
For the purpose of the following example, the Splunk field rule maps to a table in Azure Monitor, and Splunk's default timestamp maps to the Logs Analytics ingestion_time() column.
In Splunk, you can omit the
search keyword and specify an unquoted string. In Azure Monitor you must start each query with
find, an unquoted string is a column name, and the lookup value must be a quoted string.
Azure Monitor log queries start from a tabular result set where the filter. In Splunk, filtering is the default operation on the current index. You can also use
where operator in Splunk, but it is not recommended.
Getting n events/rows for inspection
Azure Monitor log queries also support
take as an alias to
limit. In Splunk, if the results are ordered,
head will return the first n results. In Azure Monitor, limit is not ordered but returns the first n rows that are found.
Getting the first n events/rows ordered by a field/column
For bottom results, in Splunk you use
tail. In Azure Monitor you can specify the ordering direction with
Extending the result set with new fields/columns
Splunk also has an
eval function, which is not to be comparable with the
eval operator. Both the
eval operator in Splunk and the
extend operator in Azure Monitor only support scalar functions and arithmetic operators.
Azure Monitor uses the
project-rename operator to rename a field.
project-rename allows the query to take advantage of any indexes pre-built for a field. Splunk has a
rename operator to do the same.
Splunk does not seem to have an operator similar to
project-away. You can use the UI to filter away fields.
See the Aggregations in Azure Monitor log queries for the different aggregation functions.
Join in Splunk has significant limitations. The subquery has a limit of 10000 results (set in the deployment configuration file), and there a limited number of join flavors.
In Splunk, to sort in ascending order you must use the
reverse operator. Azure Monitor also supports defining where to put nulls, at the beginning or at the end.
|Azure Monitor||order by||
This is a similar operator in both Splunk and Azure Monitor.
Results facets, interesting fields
In Log Analytics in the Azure portal, only the first column is exposed. All columns are available through the API.
You can use
summarize arg_min() instead to reverse the order of which record gets chosen.
|Azure Monitor||summarize arg_max()||
- Go through a lesson on the writing log queries in Azure Monitor.